GDPR

UK GDPR, together with the Data Protection Act 2018, sets the rules for how organisations in the UK handle personal data. It closely mirrors the EU GDPR, which still applies when working with data about people in the EU.

What it means when we work on your data

• In most projects you are the data controller and we are the data processor. We only process personal data on your written instructions.
• We sign a data processing agreement that sets out what we process, how it is protected, and how it is returned or deleted.
• We keep personal data to the minimum the work needs, and prefer to work within your own systems.
• If a personal data breach ever affects your data, we tell you without undue delay, so you can meet your 72-hour reporting duty to the ICO.
• When a project ends, we return or delete any data we hold and confirm this in writing.

How we meet our own obligations

• Registered with the Information Commissioner's Office (ICO Reg. No. ZC281792).
• We support your data protection impact assessments (DPIAs) when a project involves higher-risk processing.
• At our size we are not required to appoint a formal Data Protection Officer, so you deal directly with the person responsible: Paul Makauskas, paul@prestigebi.com.
• Our security measures are described on our Data Security page.

A note on "GDPR certification"

There is no official GDPR certificate that a business can simply obtain. Compliance is shown through clear policies, proper contracts and good day-to-day practice, and that is where we focus.